clixad 0.0.1-beta.16 → 0.0.1-beta.18

package/dist/clixad.mjs

@@ -246,6 +246,11 @@ var init_client = __esm({
       referral_bonus: "referral bonus",
       redeem_code: "code redeemed",
       ad_reward: "offer reward",
+      // Our own survey, and it is deliberately not called an offer. Every other
+      // earn line on this list is a network paying for something; this one is us.
+      // The name is the only place a user would ever learn the difference, and
+      // "offer reward" would file it next to the wall it did not come from.
+      own_survey_reward: "Clixad survey",
       ad_screenout_bonus: "screenout bonus (didn't qualify)",
       ad_sponsor_impression: "sponsored line shown",
       ad_reversal: "offer reward reversed by the provider",
@@ -510,11 +515,17 @@ var init_client = __esm({
         if (!res.ok) throw new Error(`packs failed: ${res.status}`);
         return res.json();
       }
-      async checkout(pack) {
+      /**
+       * `consent` carries the two declarations § 356 (5) BGB requires before we may
+       * deliver digital content inside the withdrawal period. It is not optional:
+       * the gateway refuses a checkout without it, because starting a purchase we
+       * could not deliver instantly is worse than not starting one.
+       */
+      async checkout(pack, consent) {
         const res = await fetch(`${this.config.gatewayUrl}/v1/billing/checkout`, {
           method: "POST",
           headers: this.headers(),
-          body: JSON.stringify({ pack })
+          body: JSON.stringify({ pack, consent })
         });
         if (res.status === 401) throw await authFailure(res, "checkout");
         if (res.status === 501) throw new Error("Buying credits isn't enabled (Stripe not configured on the gateway).");
@@ -820,7 +831,18 @@ var init_client = __esm({
 });
 
 // src/config.ts
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  closeSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+  writeSync
+} from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 function sameEndpoint(a, b) {
@@ -835,11 +857,42 @@ function sameEndpoint(a, b) {
   };
   return norm(a) === norm(b);
 }
-function loadConfig() {
-  let stored = {};
+function takeConfigNotices() {
+  const out = notices;
+  notices = [];
+  return out;
+}
+function readStored() {
+  let raw;
+  try {
+    raw = readFileSync(CONFIG_PATH, "utf8");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") return { stored: {} };
+    return { stored: {}, problem: `could not be read (${code ?? err.message})` };
+  }
+  if (raw.trim() === "") return { stored: {}, problem: "was empty", raw };
+  let parsed;
   try {
-    stored = JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
+    parsed = JSON.parse(raw);
   } catch {
+    return { stored: {}, problem: "is not valid JSON", raw };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { stored: {}, problem: "is not a JSON object", raw };
+  }
+  return { stored: parsed };
+}
+function loadConfig() {
+  notices = [];
+  envApplied.clear();
+  const read = readStored();
+  const stored = read.stored;
+  if (read.problem) {
+    notices.push(
+      `Your Clixad config (${CONFIG_PATH}) ${read.problem}, so this session starts signed out.
+  It is kept at ${QUARANTINE_PATH} the next time anything is saved \u2014 sign in again with \`/login\`.`
+    );
   }
   const mintedAgainst = stored.gatewayUrl;
   for (const [key, stale] of Object.entries(SUPERSEDED_DEFAULTS)) {
@@ -851,17 +904,76 @@ function loadConfig() {
   const config = { ...DEFAULTS, ...stored };
   for (const [key, envVar] of ENV_OVERRIDES) {
     const value = process.env[envVar];
-    if (value) config[key] = value;
+    if (value) {
+      config[key] = value;
+      envApplied.add(key);
+    }
   }
-  const migratedGateway = mintedAgainst !== void 0 && stored.gatewayUrl === void 0;
-  if (migratedGateway && !sameEndpoint(mintedAgainst, config.gatewayUrl)) {
+  const boundTo = stored.tokenGateway ?? mintedAgainst;
+  const redirected = envApplied.has("gatewayUrl");
+  if (!redirected && boundTo !== void 0 && !sameEndpoint(boundTo, config.gatewayUrl)) {
+    if (stored.token !== void 0) {
+      notices.push(
+        `Signed out: the saved account belongs to ${boundTo}, and this run talks to ${config.gatewayUrl}.
+  Sign in again with \`/login\` (or \`clixad login\`).`
+      );
+    }
     for (const key of IDENTITY_KEYS) delete config[key];
   }
+  baseline = { ...config };
   return config;
 }
+function changedKeys(config) {
+  const current = config;
+  if (!baseline) return Object.keys(current);
+  const before = baseline;
+  const keys = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(current)]);
+  return [...keys].filter((key) => before[key] !== current[key]);
+}
+function writeAtomically(contents) {
+  const tmp = `${CONFIG_PATH}.${process.pid}.tmp`;
+  try {
+    const fd = openSync(tmp, "w", 384);
+    try {
+      writeSync(fd, contents);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    renameSync(tmp, CONFIG_PATH);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
 function saveConfig(config) {
   mkdirSync(dirname(CONFIG_PATH), { recursive: true, mode: 448 });
-  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { encoding: "utf8", mode: 384 });
+  const changed = changedKeys(config);
+  const current = readStored();
+  let base = {};
+  if (current.problem) {
+    if (current.raw !== void 0) {
+      try {
+        writeFileSync(QUARANTINE_PATH, current.raw, { encoding: "utf8", mode: 384 });
+      } catch {
+      }
+    }
+  } else {
+    base = current.stored;
+  }
+  const next = { ...base };
+  const source = config;
+  for (const key of changed) {
+    const value = source[key];
+    if (value === void 0) delete next[key];
+    else next[key] = value;
+  }
+  writeAtomically(`${JSON.stringify(next, null, 2)}
+`);
+  baseline = { ...config };
   try {
     chmodSync(CONFIG_PATH, 384);
   } catch {
@@ -870,11 +982,12 @@ function saveConfig(config) {
 function configPath() {
   return CONFIG_PATH;
 }
-var CONFIG_PATH, DEFAULTS, ENV_OVERRIDES, SUPERSEDED_DEFAULTS, IDENTITY_KEYS;
+var CONFIG_PATH, QUARANTINE_PATH, DEFAULTS, ENV_OVERRIDES, SUPERSEDED_DEFAULTS, IDENTITY_KEYS, baseline, envApplied, notices;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     CONFIG_PATH = join(homedir(), ".clixad", "config.json");
+    QUARANTINE_PATH = `${CONFIG_PATH}.corrupt`;
     DEFAULTS = {
       gatewayUrl: "https://clixad.onrender.com",
       // Same origin as the gateway: the ad wall is served by the gateway process
@@ -892,7 +1005,9 @@ var init_config = __esm({
       gatewayUrl: ["http://127.0.0.1:8787", "http://localhost:8787"],
       dashboardUrl: ["http://127.0.0.1:8788", "http://localhost:8788"]
     };
-    IDENTITY_KEYS = ["token", "userId", "email", "login"];
+    IDENTITY_KEYS = ["token", "userId", "email", "login", "tokenGateway"];
+    envApplied = /* @__PURE__ */ new Set();
+    notices = [];
   }
 });
 
@@ -952,6 +1067,7 @@ async function githubLogin(client, config, start, invite, report, signal) {
       config.userId = poll.userId;
       config.email = poll.email;
       config.login = poll.login;
+      config.tokenGateway = config.gatewayUrl;
       saveConfig(config);
       return {
         status: "ok",
@@ -981,6 +1097,7 @@ async function devLogin(client, config, email, invite) {
   config.token = res.token;
   config.userId = res.userId;
   config.email = res.email;
+  config.tokenGateway = config.gatewayUrl;
   delete config.login;
   saveConfig(config);
   return { status: "ok", account: { email: res.email, balance: res.balance, created: true } };
@@ -1001,12 +1118,18 @@ function sleep(ms, signal) {
     signal.addEventListener("abort", done, { once: true });
   });
 }
+var TERMS_URL, PRIVACY_URL, TERMS_NOTICE;
 var init_login = __esm({
   "src/login.ts"() {
     "use strict";
     init_client();
     init_browser();
     init_config();
+    TERMS_URL = "https://clixad.io/terms.html";
+    PRIVACY_URL = "https://clixad.io/privacy.html";
+    TERMS_NOTICE = `By creating an account you confirm that you are at least 18 and that you agree to
+the Terms \u2014 ${TERMS_URL}
+and the Privacy Policy \u2014 ${PRIVACY_URL}`;
   }
 });
 
@@ -5117,7 +5240,7 @@ function useTerminalSize() {
   }, [stdout]);
   return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
 }
-function App({ client, config, wallet, streak, session, initialTask, sponsorServe }) {
+function App({ client, config, wallet, streak, session, initialTask, notices: notices2, sponsorServe }) {
   const { exit } = useApp();
   const { stdout, write: writeToStdout } = useStdout();
   const idRef = useRef(1);
@@ -5271,6 +5394,7 @@ function App({ client, config, wallet, streak, session, initialTask, sponsorServ
   useEffect(() => dropDelta, [dropDelta]);
   useEffect(() => {
     client.onNotice = (text2) => push({ kind: "notice", tone: "warn", text: text2 });
+    for (const text2 of notices2 ?? []) push({ kind: "notice", tone: "warn", text: `  ${text2}` });
     const files = contextRef.current.files;
     if (files.length) push({ kind: "notice", text: `  context: ${files.join(", ")}` });
     const streakLine = streak && streak.claimed ? streakLabel(streak) : null;
@@ -5639,6 +5763,7 @@ ${NO_SEARCH_INSTRUCTION}`),
   const runLogin = useCallback(
     async (arg) => {
       const args = parseLoginArgs(arg.split(/\s+/).filter(Boolean));
+      push({ kind: "notice", text: TERMS_NOTICE });
       await runBusy(SIGNING_IN, async (signal) => {
         const outcome = await performLogin(
           client,
@@ -6719,6 +6844,7 @@ init_kimi();
 init_banner();
 init_browser();
 init_color();
+import { createInterface } from "node:readline/promises";
 
 // src/title.ts
 var APP_TITLE = "Clixad";
@@ -6755,6 +6881,8 @@ async function main() {
   const [cmd, ...rest] = process.argv.slice(2);
   const config = loadConfig();
   const client = new GatewayClient(config);
+  const configNotices = takeConfigNotices();
+  for (const text of configNotices) console.error(c.yellow(text));
   switch (cmd) {
     case "login":
       return login(client, config, rest);
@@ -6779,15 +6907,15 @@ async function main() {
     case "ask":
       return ask(client, config, rest.join(" "));
     case "agent":
-      return repl(client, config, { task: rest.join(" ").trim() || void 0 });
+      return repl(client, config, { task: rest.join(" ").trim() || void 0, notices: configNotices });
     case "-p":
     case "--print":
       return printCmd(client, config, rest.join(" ").trim());
     case "-c":
     case "--continue":
-      return repl(client, config, { resume: "latest" });
+      return repl(client, config, { resume: "latest", notices: configNotices });
     case "--resume":
-      return repl(client, config, { resume: rest[0] ?? "pick" });
+      return repl(client, config, { resume: rest[0] ?? "pick", notices: configNotices });
     case "code":
       return codeCmd(client, config, rest);
     case "help":
@@ -6802,7 +6930,7 @@ async function main() {
     case "-v":
       return void console.log(VERSION);
     case void 0:
-      return repl(client, config);
+      return repl(client, config, { notices: configNotices });
     default:
       if (cmd.startsWith("-")) {
         console.error(c.red(`unknown option: ${cmd}`));
@@ -6810,11 +6938,12 @@ async function main() {
         process.exitCode = 1;
         return;
       }
-      return repl(client, config, { task: [cmd, ...rest].join(" ").trim() });
+      return repl(client, config, { task: [cmd, ...rest].join(" ").trim(), notices: configNotices });
   }
 }
 async function login(client, config, args) {
   const parsed = parseLoginArgs(args);
+  for (const line2 of TERMS_NOTICE.split("\n")) console.log(c.dim(`  ${line2}`));
   const outcome = await performLogin(client, config, parsed, {
     verify(start) {
       console.log(`
@@ -6878,10 +7007,7 @@ function wrapPlain(text, width) {
 var sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
 var credits = (n) => n.toLocaleString("en-US");
 function logout(config) {
-  delete config.token;
-  delete config.userId;
-  delete config.email;
-  delete config.login;
+  for (const key of IDENTITY_KEYS) delete config[key];
   saveConfig(config);
   console.log(c.green("\u2713 logged out"));
 }
@@ -7020,9 +7146,20 @@ async function buyCmd(client, config, pack) {
     console.log(c.dim("\n  buy one with: clixad buy <id>"));
     return;
   }
+  const chosen = packs.find((x) => x.id === pack);
+  if (!chosen) {
+    console.log(c.red(`  unknown pack: ${pack}`));
+    return console.log(c.dim(`  try one of: ${packs.map((x) => x.id).join(", ")}`));
+  }
+  const consented = await confirmWithdrawalWaiver(chosen);
+  if (!consented) return;
   let checkout;
   try {
-    checkout = await client.checkout(pack);
+    checkout = await client.checkout(pack, {
+      requestImmediatePerformance: true,
+      acknowledgeLossOfWithdrawal: true,
+      at: (/* @__PURE__ */ new Date()).toISOString()
+    });
   } catch (err) {
     return console.log(c.red(err.message));
   }
@@ -7045,6 +7182,39 @@ async function buyCmd(client, config, pack) {
   }
   console.log(c.yellow("\n  No credits yet \u2014 the webhook may be delayed. Check `clixad wallet`."));
 }
+async function confirmWithdrawalWaiver(pack) {
+  if (!process.stdin.isTTY) {
+    console.log(c.yellow("\n  Buying credits needs an interactive terminal."));
+    console.log(
+      c.dim("  We have to record your confirmation before charging you, and a pipe has nobody to ask.")
+    );
+    return false;
+  }
+  const price = "$" + pack.price_usd.toFixed(2);
+  console.log(`
+  ${c.bold(pack.label)} \u2014 ${credits(pack.credits)} credits for ${c.bold(price)}`);
+  console.log(c.dim(`  One purchase. No subscription, nothing to cancel. Terms: ${TERMS_URL}`));
+  console.log("\n  Before you pay, please confirm:");
+  console.log("    \xB7 You request that we deliver the credits immediately, before the");
+  console.log("      14-day withdrawal period has expired.");
+  console.log("    \xB7 You acknowledge that your right of withdrawal lapses once they");
+  console.log("      have been delivered.");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  let answer = "";
+  try {
+    answer = (await rl.question(`
+  Type ${c.bold("yes")} to continue: `)).trim().toLowerCase();
+  } catch {
+    answer = "";
+  } finally {
+    rl.close();
+  }
+  if (answer !== "yes" && answer !== "y") {
+    console.log(c.dim("\n  Cancelled. You have not been charged."));
+    return false;
+  }
+  return true;
+}
 async function ask(client, config, prompt) {
   if (!prompt) return console.error(c.red('usage: clixad ask "your prompt"'));
   const messages = [{ role: "user", content: prompt }];
@@ -7176,7 +7346,15 @@ async function repl(client, config, opts = {}) {
   const wallet = await safeWallet(client);
   clearScreen();
   const { startTui: startTui2 } = await Promise.resolve().then(() => (init_tui(), tui_exports));
-  await startTui2({ client, config, wallet, streak, session, initialTask: opts.task });
+  await startTui2({
+    client,
+    config,
+    wallet,
+    streak,
+    session,
+    initialTask: opts.task,
+    ...opts.notices?.length ? { notices: opts.notices } : {}
+  });
 }
 async function runTurn(client, config, messages) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clixad",
-  "version": "0.0.1-beta.16",
+  "version": "0.0.1-beta.18",
   "description": "Free AI coding agent in your terminal, funded by rewarded ads.",
   "license": "UNLICENSED",
   "type": "module",